eduroam on Passpoint/NGH Updates and the City Wi‐Fi Roaming 2018

Hideaki Goto Tohoku University / NII

1

Aug. 7, 2018IAM TF meeting @ APAN46, Auckland, NZ 

Security threats in the current Public Wi‐Fi

No doubt, open Wi-Fi is completely unsecure! Vulnerable to Eavesdropping, MITM attacks. Anyone can set up Evil Twin Access Points.

(Even with WPA-PSK)Malicious scripts may be screwed in by the

Captive Portal and/or AP itself.No means to check if the AP is genuine or not.

2

Internet

user

attacker

Genuine AP

Fake AP

SSID: XXopen

SSID: XXopen

Hey,use dot1X orPasspoint!

Better Public Wi‐Fi with Passpoint (Hotspot 2.0)

Some operators provide secure Wi-Fi option: San Francisco & San Jose Wi-Fi (2014) Orange Romania (2014) LinkNYC (2016), InLinkUK (2017, planned) Boingo provides Passpoint Secure at

25+ airports in US, Brazil, Portugal US phones come with built-in

Passpoint, enabling automatic connection to Wi-Fi

...

3

Look!

Wi‐Fi Alliance and Wireless Broadband Alliance (WBA) are promoting Passpoint/NGH.

Passpoint (aka Hotspot 2.0) and NGH

IEEE 802.11uGAS: Generic Advertisement ServiceANQP: Access Network Query Protocol

Profiles matching between AP and terminal.(key: NAI realm, OI, or MCC/MNC)

Automatic SSID selection.(SSID no longer acts as a selection key.)

IEEE 802.1xEAP‐SIM/AKA, EAP‐TLS, EAP‐TTLS

Same as the conventional dot1X, enabling automatic & secure connections.

OSU

Next Generation Hotspot (NGH):Passpoint + Roaming (+ something sophisticated) 4

Online Sign-Up system (optional)

5

The world becomes virtual campus!• 130+ eduroam hotspots at rental meeting rooms, cafes, etc. in the central area of Tokyo since 2011

• eduroam at airports, train stations, etc. in Sweden• eduroam on HotCity (municipal Wi‐Fi) in Luxemburg• eduroam at 18 airports in Norway• eduroam in downtowns of York, Munich, Porto, etc.• 132 hospitals in the UK  (as of 2017)

5

How can we enable off‐campus eduroam services?Ask Free Wi-Fi operators to add “eduroam” SSID. conventional way w/ minimal impact to users can be costly as many Free Wi-Fi systems

require additional supports for dot1X enabling a lot of SSIDs may hit the AP’s limit

and also deteriorate the performanceEnable roaming with secured Free Wi-Fimaybe much easier in negotiations with

operators can be less costly different SSIDs

Passpoint/NGH is a hope. 6

New scheme

NGH Special Interest Group (NGHSIG) Since Jan. 2017

• Push forward dot1X adoption and Hotspot 2.0 deployment to make Public Wi-Fi secure.

• Exchange and accumulate technical info. about RADIUS, roaming, and HS2.0.

• Provide NGH testbed for development and pilot services.• Develop an inter-roaming architecture,

“eduroam/govroam on NGH”• Survey on legal aspects and compile rules.

7

https://nghsig.jp/en/

Cityroam since 2018

8

New service brand in Japan.Secured Free Wi-Fi with roaming for anyone.

IdP: eduroam, ANYROAM, NGHSIG Cloud IdP, etc.(planned: telcos/ISPs and cities via NGH hub)

SP: Free Wi-Fi operators supporting 1X/Passpoint

City Wi‐Fi Roaming 2017

eduroam/NGH-readyhotel in Kyoto. 9

An NGH trial program by WBAPeriod: World Wi-Fi Day (June 20) – Aug. 20 40 carriers, some Wireless ISPs, and about 20 cities Tohoku University became the first academic

institution participating in the trial.(NGHSIG as the first NGH operator in Japan)

Five spots inthe country.

eduroam on NGHRoaming tests during the City Wi-FI Roaming trial,

enabling eduroam service on City Wi-Fi.Connected the eduroam JP proxy to the NGH

infrastructure.RADIUS test from ER Telecom in Russia.Connection tests in Birmingham and Leeds in the UK.

Successful connection using eduroamcredentials on the Briggate Street, Leeds. 10

It works!

City Wi‐Fi Roaming 2018

11

An NGH trial program by WBAStep 1: Repeat the City Wi-Fi Roaming trial

(June 20 – TBD, 1-2 months?revised: Oct. 1 – 31)

Step 2: Create a Consortium / FederationStep 3: Permanent City Wi-Fi Roaming service

and enlarge participation

New

New

Participatingvenues & operators

TBD

eduroam operators in City Wi‐Fi Roaming 2018

12

eduroam JP (NGHSIG) eduroam Netherlands (SURFnet) eduroam Norway (UNINETT) eduroam Managed IdP Service (eduroam.org) (Other operators/cities can still hop on!)

New

UK NL BE JP

NGHhub

govroam

13

Inter-roaming Hub layer for connecting Roaming Consortia

NGH hub operators

UK NL BE USNL NO JP

NL NO JP

XXroam

NGHhubNGH

hub

All AuthN requests with .jp realms except the known operators’.

Inter‐roamingHub layer

NGHhub

NGHhub

How to develop eduroam on Public Wi‐Fi in your region?Find some Free Wi-Fi operators and municipal

governments that would be interested in Security, Roaming, and better Tourist Attractions. Persuade them to support Passpoint/NGH.Set up an inter-roaming hub in the country or

territory.Participate in the City Wi-Fi Roaming trial at WBA

together with the operators.

14

Roaming agreement for eduroam-on-NGH is on a per-country basis.Please contact me if you are interested in testing the NGH.